[00:00.000 --> 00:05.940]  All right, cool. We're going to start going now. So my name is Justin. I work for Delphi
[00:05.940 --> 00:10.840]  Automotive, who is sponsoring the Car Hacking Village. I run the red team testing lab there.
[00:10.880 --> 00:14.280]  So my team, who you'll see around here, is the ones that are going to be doing demos and
[00:14.280 --> 00:19.240]  doing a lot of this stuff for us. But we hack our own modules to help our engineers secure
[00:19.240 --> 00:24.820]  them better. So to get into this a little bit, starting off at the Car Hacking Village, we
[00:24.820 --> 00:29.160]  do have a CTF there this year. It's really, really cool. They've got lots of different
[00:29.160 --> 00:34.000]  interfaces, lots of different systems to hack into. The first place prize is this truck
[00:34.000 --> 00:39.260]  over here. So if you guys want to play around, you can win a truck. Another prize that we're
[00:39.260 --> 00:42.900]  going to be giving away is this antenna that we're going to be demoing for you guys. So you
[00:42.900 --> 00:48.540]  can see right here, this is a GPS helical directional antenna. We'll go into the making of
[00:48.540 --> 00:55.180]  that as well in a little bit. So to, yeah, going back to our day job. So we're a Delphi
[00:55.180 --> 01:00.540]  cybersecurity testing team. We do pen testing for the company, process and tool development as
[01:00.540 --> 01:04.060]  well as research and development. This is what our facility looks like. We've got a bunch of
[01:04.060 --> 01:10.040]  garage bays we can pull cars into and a pretty big facility to do testing on modules. So
[01:10.040 --> 01:14.000]  now moving into the outline, we're going to talk about different test interfaces on the
[01:14.000 --> 01:18.080]  wireless side as well as tool kits for it. Just to help you guys out in case you may not have
[01:18.080 --> 01:21.360]  tested or done this stuff before. So we'll just kind of give you the rundown of what we're
[01:21.360 --> 01:26.120]  using and what works for us. Then we're going to do a demo on key fob analysis. So we're
[01:26.120 --> 01:30.600]  going to use GNU radio and a hack RF to do some analysis on key fob to show you how to pull
[01:30.600 --> 01:34.640]  those out of the air and do a deep dive into those. And then we're going to go into building
[01:34.640 --> 01:39.500]  directional antenna, which is this guy over here in the front, Brian, who's the mastermind
[01:39.500 --> 01:44.000]  behind that. And then we're going to get into the demo of actually directionally pointing GPS
[01:44.000 --> 01:49.060]  over here and showing you how that antenna works. All right, so now this stuff I'll run
[01:49.060 --> 01:52.660]  through quick because you guys probably know a lot of this. This is just a typical Wi-Fi
[01:52.660 --> 01:56.780]  standards. So I just wanted to throw this in here so you had it all. Here's some tools that
[01:56.780 --> 02:02.240]  you guys can use for Wi-Fi. We don't do too much Wi-Fi stuff in cars. I mean pretty much
[02:02.240 --> 02:07.600]  most of them have WPA2. So unless you can bypass the password, which they're getting a
[02:07.600 --> 02:11.120]  little bit better. The car companies are slowly getting better at making good passwords on
[02:12.460 --> 02:17.360]  WPA2. But that's really the only weakness that we're seeing. So yeah, we'll go to the next
[02:17.360 --> 02:21.220]  one, which is going to be Bluetooth. Bluetooth was a lot more vulnerable in the older
[02:21.220 --> 02:26.060]  versions. So any older cars that have older versions of Bluetooth in it are extremely
[02:26.060 --> 02:32.160]  vulnerable to those types of attacks. Here's some more specs on that. It's another RF
[02:32.160 --> 02:38.240]  spectrum that sits in the 2.4 gigahertz range. The Bluetooth version 5 is really nice
[02:38.240 --> 02:42.840]  because it's bumping up the speed like crazy. And mainly the, whoops, mainly the distance
[02:42.840 --> 02:47.200]  which is nice. Just because all these different devices people are making in their houses,
[02:47.200 --> 02:50.920]  you can go a lot more farther in your house. But then for us, if we want to do drive-bys, we
[02:50.920 --> 02:56.080]  can also get into their stuff. So here's some tools that we use for Bluetooth testing. The
[02:56.080 --> 02:59.940]  UberTooth one is really helpful. And then we just use this adapter. It's really easy. We
[02:59.940 --> 03:03.160]  can transmit on this. We can do whatever we want with this device. Some Bluetooth devices
[03:03.160 --> 03:08.180]  won't allow you to. So now moving into cellular, there's three different areas that we
[03:08.180 --> 03:12.360]  focus on in cellular. This is just giving you a rundown of spectrums. So whenever we're
[03:12.360 --> 03:16.040]  trying to dig into a new technology or understand it more, this is the type of data we
[03:16.040 --> 03:19.760]  compile to start digging and understanding what tools we want to buy. And then we start
[03:19.760 --> 03:24.680]  reaching out to vendors or coming to events like this and buying all the hacker tools. So
[03:24.680 --> 03:31.100]  when you're getting into cellular related stuff or any wireless stuff on cars, it's
[03:31.100 --> 03:35.300]  recommended to look for this type of content on any of the modules. Mainly something with
[03:35.300 --> 03:39.680]  the FCC ID or even an IMEI number. It's going to let you know there's a cell network in
[03:39.680 --> 03:43.960]  here and there's transmitting some kind of RF somewhere. So this is how we quickly can
[03:43.960 --> 03:49.060]  move on to understanding what's coming out of this module. So now looking into the tools
[03:49.060 --> 03:53.960]  that we use, we're, um, trying to find what works best for us. So we buy a lot of industry
[03:53.960 --> 03:57.200]  based tools like this guy up here. This is from Roden Schwartz. It's a cell site
[03:57.200 --> 04:01.700]  simulator. So this will actually put up a cell tower for you. You put a SIM card in your
[04:01.700 --> 04:05.160]  phone or whatever you need to and now you can see all the data streams and everything
[04:05.160 --> 04:08.300]  that's going back and forth from that phone. So it's really helpful for us when we're
[04:08.300 --> 04:11.480]  trying to test apps in cars that people are building to understand if they're actually
[04:11.480 --> 04:14.960]  communicating to the server securely and what type of data they're sending back and forth.
[04:15.340 --> 04:19.860]  Um, and then for putting up base stations, um, on a cheaper way, you can use a blade RF
[04:19.860 --> 04:25.700]  with the HBTS or this USRP device with the HBTS as well. Those are a little bit cheaper
[04:25.700 --> 04:31.680]  routes to go and you get a lot more custom, uh, customizability with those. Um, next is
[04:31.680 --> 04:35.500]  moving on to key fob, which we're going to show you the demo on. This is something that was
[04:35.500 --> 04:40.460]  introduced in 1980 by Ford. Um, there's two main frequencies, which is 3.5 megahertz and
[04:41.240 --> 04:47.320]  433.92 megahertz. Um, the distance is 5 to 20 meters and the security on this is mainly
[04:47.320 --> 04:52.500]  rolling codes and challenge response. A couple years ago you guys may have seen a guy named
[04:52.500 --> 04:59.060]  Sammy Kamkar create a device that was able to bypass or, you know, leverage rolling codes to
[04:59.060 --> 05:03.440]  be able to get into people's cars. Um, there's also passive key entry systems, which are
[05:03.440 --> 05:07.480]  running stuff in the, uh, kilohertz range. So when you walk up to your car and you want to
[05:07.480 --> 05:11.360]  unlock it with just your button, uh, or the handle on the car, that's usually using
[05:11.360 --> 05:16.600]  something in the kilohertz range. And that's called passive key entry. So here's some
[05:16.600 --> 05:21.620]  tools that we use for, uh, the key fob stuff. We mainly are using the hacker refs, but the
[05:21.620 --> 05:26.800]  spectrum analyzer is really helpful to see those packets coming across. Um, and then we
[05:26.800 --> 05:31.880]  also use the yardstick one because that goes down to the lower kilohertz. So now moving on
[05:31.880 --> 05:36.280]  to GPS, which we'll show you a demo on that as well. This is something that was created by the
[05:36.280 --> 05:40.520]  United States in the 70s. Um, there's a few different bands. The ones that are mainly
[05:40.520 --> 05:46.740]  public are L1 and L2. Uh, if you want to lock down GPS properly, use both radios in your
[05:46.740 --> 05:51.540]  devices. Most people don't. I know Apple doesn't and we can show you what happens with that
[05:51.540 --> 05:56.120]  because they don't. Um, we'll pretty much can put anybody's phone wherever we want if you're
[05:56.120 --> 05:59.640]  only using one band because your phone's only relying on that band so it's not getting
[05:59.640 --> 06:04.680]  another source to say, hey, you're not actually here, you should be here. Um, so we'll show
[06:04.680 --> 06:09.700]  you what, how that can be messed with. Um, some different tools we're using for this. You
[06:09.700 --> 06:13.740]  can use a hacker ref. Uh, they're kind of hard because you got to stack a bunch because you
[06:13.740 --> 06:19.020]  have to do transmitting and receiving. Um, and then we mainly use a blader ref, um, which we
[06:19.020 --> 06:23.740]  have set up here connected to this antenna. So we'll show you that in a moment. And then the
[06:23.740 --> 06:26.900]  next one, the last one, which is a fun one, which you guys may not have heard of yet. This
[06:26.900 --> 06:30.300]  is something that's coming in cars. It's kind of scary from my perspective because of what
[06:30.300 --> 06:34.300]  they're trying to do with it. But it is something that's needed. Cars do need to talk. If
[06:34.300 --> 06:37.820]  we're going to have autonomous cars down the road, they do have to talk to each other in some
[06:37.820 --> 06:41.860]  manner. So this is currently the automotive solution for that. It's called vehicle to
[06:41.860 --> 06:49.460]  everything. Um, it runs just above, uh, the 5 gigahertz range and it has a protocol of 80211P
[06:49.460 --> 06:55.940]  which is very similar to all the WiFi standards. It's really not that much different. The
[06:55.940 --> 07:02.840]  only difference is it's got this IEEE 1609 application layer on top of it. And then here's
[07:02.840 --> 07:07.300]  some tools that we use for that. Um, if you're looking into development tools, these are
[07:07.300 --> 07:10.740]  just the hacker type tools besides this one. But another development tool you can look to is
[07:10.740 --> 07:15.760]  something called Coda Wireless or MK5. Um, that'll allow you to actually transmit and do
[07:15.760 --> 07:19.680]  some V2X based stuff. And another one from the auto industry is pretty big. It's Vector
[07:19.680 --> 07:23.940]  Canoe. They're really expensive so hopefully in the near future some hackers will release
[07:23.940 --> 07:28.380]  some tools that are a lot cheaper for you guys. All right, now we can move into this, uh,
[07:28.380 --> 07:47.410]  key fob analysis if you're ready, Dave. Hi everybody, my name is Dave Conant. I work for
[07:47.410 --> 07:53.510]  Adelphi along with Justin and I'm sort of the radio guy, I guess, uh, over there. Is my
[07:53.510 --> 08:19.260]  screen popping up here? No? How do I... Oh, there we go. That's interesting. Okay, so
[08:19.280 --> 08:31.680]  well, if you can't see it, I'm gonna have a hard time demoing it. There we go. All right, so
[08:31.680 --> 08:37.240]  who's used GNU radio before? Anybody in here? Has anybody, for the people who haven't used
[08:37.240 --> 08:42.480]  it, have you heard GNU radio? Okay, so if you haven't used GNU radio or you've heard of it,
[08:42.480 --> 08:46.520]  I'm gonna explain just the basics of what this thing does. It's a, it's a useful tool that we
[08:46.520 --> 08:52.360]  use in the lab, uh, that we use to isolate different wireless signals. So Justin spoke
[08:52.360 --> 08:57.820]  about GPS, you know, DSRC, but at the end of the day, in the radio frequency spectrum, you
[08:57.820 --> 09:02.580]  know, vehicles themselves, they have like 15 different radios on them, your phone probably
[09:02.580 --> 09:07.720]  has like 6 or 7, you know, you got Bluetooth, Wi-Fi, but then what about the non-standard
[09:07.720 --> 09:12.740]  wireless? So I, you know, I've got my key fob here for my truck, for example. Now this thing
[09:12.740 --> 09:19.020]  doesn't speak Wi-Fi, it doesn't speak GPS, so how do we deal with signals when we don't
[09:19.020 --> 09:23.620]  really have, you know, like a Wi-Fi adapter to like just let us authenticate to it? Uh,
[09:23.620 --> 09:28.280]  basically, uh, from the blue reverse engineering random wireless signals and looking at the
[09:28.280 --> 09:33.700]  binary data, uh, inside of them. So I wanna show you 2 tools that we use in the lab, uh, to
[09:33.700 --> 09:39.300]  isolate these signals and, and how we can decode the actual binary data, uh, off of that so we
[09:39.300 --> 09:43.920]  can actually send and communicate with, uh, with these basic devices. It's actually
[09:43.920 --> 09:50.380]  generally speaking easier to talk to these guys than something like using Wi-Fi. It's much
[09:50.380 --> 09:54.940]  less complicated. So for example, with your key fob, it's just a series of bits and if the
[09:54.940 --> 09:59.720]  car hears that, the right series of bits, there's no handshake, it just says, oh, I like
[09:59.720 --> 10:03.780]  those bits, I'm gonna open up the, the car. It's that simple. So as long as you know that
[10:03.780 --> 10:09.200]  code or how to generate that code, uh, then you can talk to it. So actually being able to
[10:09.200 --> 10:12.780]  read the code off of the air if you don't know what the wireless signal looks like is a
[10:12.780 --> 10:17.580]  very useful skill to have in general. Um, Defcon, we've seen talks that guys talk to
[10:17.580 --> 10:22.340]  satellites using these techniques, you can talk to cars, uh, anything that transmits a
[10:22.340 --> 10:27.180]  wireless signal that you can talk to. So I'm using a hack RF, I think the range on this
[10:27.180 --> 10:35.240]  thing in frequency terms is, uh, it goes up to 6 gigahertz and down to 10 megahertz? 1
[10:35.240 --> 10:39.980]  megahertz? 1 megahertz. That's a huge range. Uh, this is actually a monumental invention,
[10:39.980 --> 10:44.220]  software defined radio in general. Uh, having this kind of power to be able to transmit and
[10:44.220 --> 10:49.400]  receive on that wide a frequency range is something that 10 years ago even would have cost
[10:49.400 --> 10:54.040]  millions of dollars in equipment and would have been military classified type technology. So
[10:54.040 --> 11:00.060]  please get one and learn how to use them. They're very awesome. Alright, so I'm opening up
[11:00.060 --> 11:06.820]  basically a utility called GQRX. GQRX, if you install GNU radio along with this, uh, you're
[11:06.820 --> 11:12.100]  gonna be covered. So I'm gonna move this guy over here. GQRX, this, this guy right here is a
[11:12.100 --> 11:16.680]  spectrum analyzer. Everybody knows what that is? It's our eyes and ears on the frequency, uh,
[11:16.680 --> 11:21.760]  the frequency realm. This lets us see our wireless signals. This guy and most spectrum
[11:21.760 --> 11:28.480]  analyzers cost between, mm, at least $10,000 up to $500,000 to a million dollars. Just to
[11:28.480 --> 11:32.480]  give you an idea of what it's like just to see, uh, a spectrum range that we're talking about
[11:32.480 --> 11:39.440]  here. HackRF costs I think $200 or $300 and it can see almost the same range as this guy. This,
[11:39.440 --> 11:44.120]  this guy's still better, it's more accurate but the HackRF's good enough for us hackers. And
[11:44.120 --> 11:51.980]  GQRX, I wanna show you, basically does the same thing that our $200,000 spectrum analyzer over
[11:51.980 --> 11:59.080]  here does. And you can actually see they look very similar and I'm going to use GQRX to move
[11:59.080 --> 12:05.760]  down and find my key fob signal to show you guys what that looks like. I happen to know that
[12:05.760 --> 12:12.300]  it's 315 megahertz and everything, all your devices, they come with an FCC ID if they're
[12:12.300 --> 12:17.680]  being sold commercially so they will tell you what the frequency is on the FCC's website. Super
[12:17.680 --> 12:22.600]  useful website to look up all kinds of parameters that we're gonna use in GNU radio to decode
[12:22.600 --> 12:27.180]  this signal. So you can see here when I press my little button for my HackRF there's a little
[12:27.180 --> 12:33.820]  bumpity bump coming, it's a frequency shift key coming from my key fob. I do wanna show you as
[12:33.820 --> 12:41.960]  well, so we're looking at, I think uh, what is this? 20 megahertz in bandwidth or 16 megahertz
[12:41.960 --> 12:46.500]  I can't remember. I do wanna show you an important and difficult part in dealing with GNU radio
[12:46.500 --> 12:51.980]  is setting up the filtering. And I wanna show you just what filtering looks like in GQRX. When
[12:51.980 --> 12:56.840]  you click around you can see that little band there, it's actually filtering all the signals
[12:56.840 --> 13:02.520]  out around it and if I had my audio on it would actually play the sound for the uh, the signal
[13:02.520 --> 13:06.460]  that you're receiving. So you're narrowing in and zeroing in on that signal that you're
[13:06.460 --> 13:12.800]  looking for despite capturing 20 megahertz worth of bandwidth. So, I uh, I think my computer
[13:12.800 --> 13:24.200]  locked up. Yeah, okay. Well that's okay I was gonna close GQRX anyway and switch to GNU radio.
[13:24.200 --> 13:28.900]  The important thing to understand is when we're gonna decode this signal in GNU radio and get
[13:28.900 --> 13:35.380]  the binary bits out of there, um, there's basically 4 steps and essentially we have to capture
[13:35.380 --> 13:40.720]  the signal from a source, that's obvious. And then we need to filter all the junk around it
[13:40.720 --> 13:46.520]  out from the signal. And that, there's an entire series, you should watch Michael Osmond's uh,
[13:46.520 --> 13:51.280]  SDR series if you haven't already. It's uh, HackR, it's, he's the guy who created the HackRF
[13:51.280 --> 13:56.220]  and he's got an entire educational video series and he's got an entire one dedicated, an
[13:56.220 --> 14:00.340]  entire hour dedicated to filtering. It's uh, it's a science and an art. There's a lot that
[14:00.340 --> 14:05.440]  goes into it. Uh, there's many different kinds of filters, high pass, low pass, band pass,
[14:05.440 --> 14:10.980]  exflating, fur filters, blah, blah, blah. Uh, learn them all, what they do, um, they're not
[14:10.980 --> 14:15.180]  that tough but they're a little intimidating to get to at first. It's very important to zero
[14:15.180 --> 14:19.800]  in on your signal uh, with those filters though. Okay, so once you've zeroed in on your
[14:19.800 --> 14:25.060]  filter and uh, on your signal with your filter, the next step that you have to do is demodulate
[14:25.060 --> 14:29.580]  it. Uh, demodulating is gonna come in a couple different flavors. There's frequency
[14:29.580 --> 14:34.920]  demodulation and amplitude demodulation. So when you're playing around in GQRX, it will
[14:34.920 --> 14:40.320]  behoove you to figure out and identify with your eye or your ear whether you're dealing with a
[14:40.320 --> 14:45.720]  frequency shift key signal or an amplitude shift key signal. Amplitude sounds like Morse code
[14:45.720 --> 14:50.220]  or it's changing in volume. A frequency shift key is gonna have differing tones that you'll
[14:50.220 --> 14:56.120]  hear and it'll sound more like uh, like music or dubstep or something like that. So, and
[14:56.120 --> 15:01.960]  once you identify that, you can pick your frequency shift keying or, or your amplitude shift
[15:01.960 --> 15:15.110]  keying. So I've prepared new radio blocks here. Let's see if this works. Is it? No, it doesn't.
[15:17.870 --> 15:28.280]  What's that? Oh, there we go. Now wait for it for a second. Okay, I have to be fast here. So my
[15:28.280 --> 15:36.320]  program that I've written here, GNU radio, oh, whoa. It uses flowcharts to define your actual
[15:36.320 --> 15:40.680]  software. In the background of each one of these flowcharts, there's actually a Python script
[15:40.680 --> 15:45.860]  that gets executed. And you can see here, this is what I was talking about. I'm using the
[15:45.860 --> 15:51.860]  Osmocom source which is my hack RF. I set the frequency to 315 megahertz because I know that
[15:51.860 --> 15:55.820]  that's where my signal is and I set my sample rate to be about 4 megahertz. That means I'm
[15:55.820 --> 16:00.980]  capturing 4 megahertz of bandwidth around the signal. That's a lot of bandwidth. The actual
[16:00.980 --> 16:06.820]  bandwidth of this signal is like 200 kilohertz. It's not that wide. That's why I pass it into
[16:07.000 --> 16:12.380]  a filter. I'm not gonna explain all of these different uh, parameters but basically I'm
[16:12.380 --> 16:18.260]  zeroing in on the signal with this so uh, it's kind of offset from 315 megahertz. It's not
[16:18.260 --> 16:24.660]  quite exactly. It's like 314.9. You can figure that out from the FCC website. So I'm offsetting
[16:24.660 --> 16:30.820]  it to zero in on the signal and then I am shrinking down that 4 megahertz of bandwidth just
[16:30.820 --> 16:35.560]  to capture this signal alone and none of the junk that's uh, flying around it especially here
[16:35.560 --> 16:40.980]  at DEF CON. I'm then piping the signal into a frequency sync which is exactly the same thing
[16:40.980 --> 16:44.320]  as the spectrum analyzer that we see here. So we can actually see the signal that we're
[16:44.320 --> 16:50.340]  capturing and confirm that uh, that we're getting it. Demodulating the signal. And now this
[16:50.340 --> 16:55.240]  is the, the secret sauce to get the binary data out of it. So at this point, this is nice, you'll
[16:55.240 --> 16:59.320]  actually be zeroed in on a signal. You can hear it, you can record it, you can save it and you
[16:59.320 --> 17:05.160]  can import it into other analysis tools like Baudline and Spectrum or even Audacity, your
[17:05.160 --> 17:12.000]  favorite music editing program is able to read uh, this data coming out of here. So you can
[17:12.000 --> 17:17.020]  just put that into a file sync right there. But if you just wanna pull the bits out, you put
[17:17.020 --> 17:22.280]  it into a clock recovery block. The only thing you need to know to use this block is your
[17:22.280 --> 17:26.940]  baud rate of the signal. And you can look at that visually or you can look it up on the FCC.
[17:27.240 --> 17:34.720]  My key is I think 115 uh, 115,000 symbols per second. And once I know that, then I put it into
[17:34.820 --> 17:40.820]  a binary slicer that slices it into bits and I save it to a file on the temp FS. I'm gonna show
[17:40.820 --> 17:47.960]  you what that looks like when it runs right now. And I know there's a lot of information, I
[17:47.960 --> 17:51.560]  have a ton of resources for you folks that you can like walk through chapter by chapter.
[17:51.560 --> 17:55.740]  There's a lot of authors out there that have done this exact same thing and uh, they explain
[17:55.740 --> 18:00.880]  everything in far more detail than I can here today. Alright, so I'm gonna run the program,
[18:00.880 --> 18:22.010]  hopefully it'll work. I'm gonna click okay, that's fine. Alright, there's my signal. And now I'm
[18:22.010 --> 18:30.830]  just gonna exit cause I've captured what I need. So I save that to temp test. I'm gonna go
[18:30.830 --> 18:38.230]  ahead and just dump that with a hexadecimal viewer. And bingo, so you can see the pattern
[18:38.230 --> 18:44.110]  there in the bits. Zero one, zero one, zero one is basically all ones. It's a bunch of, it's a
[18:44.110 --> 18:48.850]  preamble for the signal saying hey, you're about to receive some interesting data. And right
[18:48.850 --> 18:53.750]  after that you can see that there's uh, there's the code right here. Now something I didn't
[18:53.750 --> 19:00.210]  show you in my block that if you actually wanna use this in the field, is there's something
[19:00.210 --> 19:04.310]  called uh, there's a way that you can set an access code. So hey, look for the ones in a row
[19:04.310 --> 19:09.130]  and only capture the bits that come after that. It's useful so you don't get this uh, file
[19:09.130 --> 19:14.430]  that I showed you that has all of the uh, the repeating signal here. It'll just grab the, the
[19:14.430 --> 19:17.930]  signal that you're interested in but just for the purposes of this demo I wanted to show you
[19:17.930 --> 19:22.570]  the preamble and the code, the preamble and the code, the preamble and the code. And that is
[19:22.570 --> 19:26.550]  literally the key fob signal for my truck. So if somebody wanted to take a picture of those
[19:26.550 --> 19:30.470]  ones and zeros and can find my truck in the parking lot, you could re-digitize the signal
[19:30.470 --> 19:34.570]  over the air and break into my truck. And that would be that. Anybody else wanna try pressing
[19:34.570 --> 19:38.010]  their unlock key and let me record it and uh, tell me where to make and model and where it's
[19:38.010 --> 19:43.470]  parked? No? It's really cool stuff. That's all I have for you today for my demo but that's how
[19:43.470 --> 19:48.170]  you decode a binary signal arbitrarily broadcasted over the air. You reverse the entire
[19:48.170 --> 19:53.710]  process to broadcast it out and uh, please learn how to use GNU Radio GQRX and buy yourself a
[19:53.710 --> 19:58.050]  hack RF uh, to get into this stuff. And uh, thank you very much. I'll pass it back to Justin.
[20:00.150 --> 20:06.410]  Thanks Dave. Uh, we gotta flip laptops. I gotta, I gotta flip the laptop again. Open, yeah,
[20:06.410 --> 20:29.820]  pull the HDMI. Sorry, one second while we uh, switch the demo stuff up. Alright, now we're
[20:29.820 --> 20:36.220]  gonna get into uh, the making of the antenna over there. Whenever the screen wants to load.
[20:36.220 --> 21:04.740]  Yeah, one moment. Um, HDMI. Sorry guys. Alright, here we go. Nope, no source found. Sorry,
[21:04.740 --> 21:29.200]  I, it's, I have it set up to duplicate. It looks like it's not really going in. It looks like it
[21:35.440 --> 22:23.720]  is. Sorry guys. Yeah. Um, no, it's HDMI. Actually, sure, we can try it. Oh, alright, never mind.
[22:26.120 --> 22:36.010]  We'll try this. If not, then I'll try this little dongle. There we go. Sweetness. Sorry about the
[22:36.010 --> 22:40.030]  delay guys. Alright, so now we're gonna get into uh, building a helical antenna. So this is
[22:40.030 --> 22:45.110]  gonna be presented by Brian Gillespie. This guy's a badass physics guy. He knows a lot of
[22:45.110 --> 22:50.150]  stuff in physics and now he's becoming a hacker. So, here you go, here's Brian. Alright, thank
[22:50.150 --> 23:01.700]  you Justin. Um, are you gonna index the slides since you uh, since you took? Okay, so um, I'm
[23:01.700 --> 23:06.060]  gonna just review some of the fundamentals of the, of radio physics ways as most of you probably
[23:06.060 --> 23:10.440]  know, but we need to understand that with more building things like this and uh, doing things
[23:10.440 --> 23:16.420]  that Dave's doing and other people. So, so the quick review. So here's our whole uh, RF
[23:16.420 --> 23:24.780]  spectrum of uh, that we have. You know, increasing uh, wavelength uh, we get, have the lower
[23:24.780 --> 23:30.460]  frequency and then we have uh, higher frequency, smaller, smaller wavelengths. And if you see
[23:30.460 --> 23:35.300]  where I've got that arrow pointed, radio frequencies are typically frequencies above 1
[23:35.300 --> 23:41.920]  gigahertz or 10 to the 9 hertz. Um, and they travel at the speed of light and so we go to the
[23:41.920 --> 23:45.940]  next slide here. Uh, so they travel in a straight line and they reflect. So when you're above
[23:45.940 --> 23:53.480]  that uh, frequency range, they'll bounce off uh, things like the walls. When you have the lower
[23:53.480 --> 23:58.960]  frequencies, you can have um, environmental effects on them. But for what we're doing, you know,
[23:58.960 --> 24:03.540]  the travel's at the speed of light and it's important to remember our wave equation here where
[24:03.540 --> 24:09.380]  we have uh, you know, the frequency, the frequency times the wavelength gives us the speed. So
[24:09.380 --> 24:15.920]  that's gonna be helpful when I build the antenna. And forward. So, helical antenna. This is,
[24:15.940 --> 24:24.240]  this is the main part of the talk here. So, uh, oh, backwards. So, you got your center, your
[24:24.240 --> 24:29.620]  center support here, which is uh, which is this uh, B here. And you can see that in the antenna
[24:29.620 --> 24:36.420]  over there. Uh, the coaxial feed line and then you have the insulating supports because we don't
[24:36.420 --> 24:42.060]  want any uh, connectivity anywhere else. You got the reflector ground plane and then um, you
[24:42.060 --> 24:49.460]  got your um, coaxial that feeds your signal in. Or if you want to receive, then it goes the other
[24:49.460 --> 24:53.620]  way. So there's two modes that these helical antennas can operate in. And that's the normal
[24:53.620 --> 25:01.500]  mode, uh, where the helix pitch and diameter are small compared to the wavelength and are
[25:01.500 --> 25:06.920]  omnidirectional. And then the axial mode type, N-FIRE, which is what that antenna over here is,
[25:06.920 --> 25:11.200]  is um, the diameter and the pitch are comparable to the wavelength. And you'll see that when I'm
[25:11.200 --> 25:16.700]  gonna show up here next, or coming up. So this is just kind of a visual of what it looks like from
[25:16.700 --> 25:22.140]  some simulations between an omnidirectional type antenna, which just kind of radiates out and
[25:22.140 --> 25:27.080]  spreads out, where the N-FIRE directional, which is the helical, which means we can point it at
[25:27.080 --> 25:36.350]  things, is this one here. Here's a little more animation here for us, just to show uh, what
[25:36.350 --> 25:43.310]  happens when we have a helical antenna. And that is, depending on which way the helix is oriented,
[25:43.310 --> 25:51.050]  we, uh, the waves will spin one way, or the vectors here will show the polarization. We'll be right-handed or
[25:51.050 --> 25:58.610]  left-handed, and so that's based on how this, which way that's turned. Now I don't know, uh, you took the
[25:58.610 --> 26:05.610]  animation out, it looks like. That's okay. But you can see down here, as it comes out, these waves are
[26:05.610 --> 26:12.070]  spinning around. That's the representation up here, and that's the N-FIRE for that. Okay. So this gets to
[26:12.070 --> 26:17.050]  the heart of the manner here of how to make the antenna. So I found this nice website up here that did
[26:17.050 --> 26:24.710]  most of the calculations for us. So plug in the frequency, how many turns you want, and then it pops out
[26:24.710 --> 26:29.190]  all this information that we need to build the antenna. So this is the general schematics that I, we had to
[26:29.190 --> 26:36.210]  take and interpret to, uh, you know, build that antenna that's sitting over there, so that we can use it for
[26:36.210 --> 26:43.570]  our work and, um, looking at what happens when we, uh, GPS is pointed at something that has it, and what
[26:43.570 --> 26:54.330]  impact it's gonna have for us. All right. Whoops. Okay. So real quick, take some tools to build that, and
[26:54.330 --> 27:00.330]  some design work from, from the previous slide to make all these parts here. So this is a bridge report
[27:00.330 --> 27:05.650]  mill that I was using. I was in the process of putting in the holes. All these holes are spaced, based on
[27:05.650 --> 27:10.550]  fractions of the, of wavelength on that, from that slide I, uh, showed you before. So that tells me what the
[27:10.550 --> 27:15.670]  spacing needs to be here. And then, um, from there, you need to use the lathe to make some of the other
[27:15.670 --> 27:21.430]  round parts, basically items you need. And one thing that I'm, remember that an antenna is just a wire. So
[27:21.430 --> 27:26.770]  all that is, is just a wire configured a certain way to get the frequency we need, uh, for this application,
[27:26.770 --> 27:34.230]  and some plastic, some aluminum, and other tools. All right. So there's the, oops, backwards. There's the
[27:34.230 --> 27:39.930]  antenna. And I think we're ready for the demo. So this is some things we're doing in the lab here. So you can
[27:39.930 --> 27:44.870]  see we're getting the signal. We've got a blade RF. Nick over there has got us all set up. Some of you, he's
[27:44.870 --> 27:50.850]  been broadcasting that for the whole time. So depending on your device, it could show you that it might be a
[27:50.850 --> 27:55.150]  thousand feet above Moscow. So if he points it over here, let me get out of the way, you should see the
[27:55.150 --> 28:02.230]  signal get, get stronger as he points it over here. That's the purpose of it. Now if you put your hand in
[28:02.230 --> 28:05.050]  front of it, now see it's bouncing off the wall. Put your hand in front of it when you turn it over there,
[28:05.050 --> 28:09.110]  because I checked it earlier. See, it's now, it's now, because it's reflecting off the wall, like I was
[28:09.110 --> 28:17.750]  mentioning, because it's behaving like light. So just bounce off the wall. So, and that's, uh, that's
[28:17.750 --> 28:18.330]  everything.
[28:18.890 --> 28:25.920]  We're like, this thing's not working. We're like, this thing's not working. But then we're like, oh, yeah,
[28:25.920 --> 28:31.620]  reflection, light. It's just light. So that's why if you do, I don't know if this is going to go the whole
[28:31.620 --> 28:35.160]  way, but if you do that and put your hand in front of it, it's going to put it away because now it
[28:35.160 --> 28:39.140]  can't reflect off the walls anymore. But if you do this, now it's starting to reflect off the
[28:39.140 --> 28:44.220]  wall, the walls in the room and the ceiling just like light does. Um, another thing too, we don't
[28:44.220 --> 28:49.620]  have the amp plugged in on this, so we're not giving it enough power. We could pump this thing
[28:49.620 --> 28:51.040]  or, here, I'll let Nick talk about that.
[28:51.040 --> 28:51.800]  Yeah, go ahead.
[28:52.180 --> 28:57.480]  With proper amplification, you can cover this entire casino in whatever signal you want. This
[28:57.480 --> 29:02.640]  will render all navigation GPS completely useless. You'll be wherever I tell you you are.
[29:03.500 --> 29:08.020]  Yeah, so pretty scary stuff, especially with autonomous cars coming down the road. Um,
[29:08.020 --> 29:12.280]  obviously we care about safety a lot, which is why we designed stuff like this. So we're not just
[29:12.280 --> 29:16.680]  putting everybody in the whole entire place in Moscow. Um, we're just putting everything that's
[29:16.680 --> 29:21.680]  directional over there. Um, it's a safer way of doing tests like this. Um, you know, you don't
[29:21.680 --> 29:26.920]  really want to get FCC calls. Um, so doing stuff like this and having the proper facility to do
[29:26.920 --> 29:31.340]  this stuff in is, is also really helpful. The lab we do all this testing in is pretty much a
[29:31.340 --> 29:36.520]  Faraday cage. We don't have cell inside the building. We can't get anything in or out. So we
[29:36.520 --> 29:41.660]  know the tests that we're doing inside are not affecting systems externally from our lab. So
[29:41.660 --> 29:45.980]  yeah, that's about it. Um, if you guys want to get into cars, we'll be here the whole entire
[29:45.980 --> 29:50.980]  time during DEF CON. We do, we're a part of the CTF, so we have some stuff over there you guys
[29:50.980 --> 29:54.360]  can hack into, try to find some flags and maybe win that Jeep or that truck or, uh, this
[29:54.360 --> 30:02.930]  antenna. So yeah, thank you guys for coming out and, uh, enjoy the CON. We've got a
[30:02.930 --> 30:08.570]  question for you. We're doing questions now. I realize we do have some extra time. Uh, he
[30:15.580 --> 30:21.520]  said... so if you're using both L1 and L2, that would stop an attack like this, uh, from a
[30:21.520 --> 30:26.720]  SCID if they were doing one radio. You can sync two radios, broadcast L1 and L2 for the
[30:26.720 --> 30:31.540]  correct position, but it requires manual math or a very well written program. Um, what you
[30:31.540 --> 30:35.860]  would see with both receivers is you would see that L2 is getting where you would expect,
[30:35.860 --> 30:41.320]  where L1 is not. And L2, if they broadcast, there's no open source GitHub project for that
[30:41.320 --> 30:47.880]  yet, um, but I'm gonna post it. Um, you would be able to tell also by the difference in
[30:47.880 --> 30:53.080]  timing. So we need less than five parts per million accuracy to be, or precision, to be able
[30:53.080 --> 30:58.580]  to get this to be received by your phones or any other consumer grade device. It is very
[30:58.580 --> 31:02.500]  unlikely for someone to be able to do the wiring correctly to get that kind of accuracy to be
[31:02.500 --> 31:08.060]  consistent through two radios at the exact same time. So that's a good stop for this type of,
[31:08.060 --> 31:14.580]  uh, attack. Great question. Any other questions? Yeah, we'll go with you in the red first.
[31:20.680 --> 31:25.280]  So with this attack, the question was, uh, could we impact timing? The answer is yes. Uh,
[31:25.280 --> 31:30.220]  whatever time I broadcast, um, it, it, you kind of need to know more about the, the packet
[31:30.220 --> 31:34.700]  that gets broadcast from the satellite. But basically it's, it's, it's latitude, longitude, and
[31:34.700 --> 31:39.840]  it's time of broadcast. And then your radio takes in all those signals it picks up and says,
[31:39.840 --> 31:44.460]  ah, I see the time of flight was so and so, therefore I'm here. So if I were to broadcast
[31:44.460 --> 31:50.640]  consistently a different time, yes, you would receive it and trust it. It's a very, uh, weird
[31:50.640 --> 32:00.450]  phenomenon, but people do it. They use their GPS as timers. Uh, with your RSA certificates, uh,
[32:00.450 --> 32:05.370]  time is usually a factor in that. And you can completely set the seed value for a lot of
[32:05.370 --> 32:09.310]  these embedded controllers because they'll generate the same certificate given the same
[32:09.310 --> 32:14.590]  time. So if you know what it was once, you can just tell it it's the same time over and over
[32:14.590 --> 32:19.830]  again. And all of a sudden you're able to get the same certificate all the time. Which means
[32:19.830 --> 32:26.990]  now you can man the middle, even if they rotate their certs. Funky little CS problems become
[32:26.990 --> 32:44.560]  very big security holes. Any other questions? Cool. So that's a good question. Um, we don't
[32:44.560 --> 32:49.280]  directly focus on the full vehicle yet. Uh, we're mainly focused on modules. So if you guys
[32:49.280 --> 32:54.000]  don't know what Delphi does, they create a lot of the safety, uh, systems in your cars as
[32:54.000 --> 32:58.480]  well as infotainment systems in your vehicles. Um, so right now our focus is strictly on
[32:58.480 --> 33:03.200]  protecting our parts. Um, down the road we do want to have, uh, offerings to like our
[33:03.200 --> 33:07.100]  customers, OEMs, where we could do full vehicle assessments for them. But right now it's
[33:07.100 --> 33:13.620]  strictly on the, um, module side. I did a talk, um, a few months ago at SANS that kind of laid
[33:13.620 --> 33:17.060]  out a lot of this stuff. I can get you that link and there's a presentation in there that'll
[33:17.060 --> 33:29.940]  show you more details of what we did for that. Yep. Uh, we do, yes. And we also focus, uh,
[33:29.940 --> 33:34.760]  sorry, the question was, um, are we only focusing on like our ECUs or the interfaces that
[33:34.760 --> 33:39.120]  are coming in from other stuff? Uh, and the answer is absolutely the stuff that's coming
[33:39.120 --> 33:42.800]  from other systems. And that's why even the wireless stuff, you know, when stuff's coming
[33:42.800 --> 33:47.380]  over wireless, we're testing that. We don't only look inside our systems, we look on the
[33:47.380 --> 33:51.000]  interfaces and anything that's connecting to the systems. Um, a lot of that's hard to test
[33:51.000 --> 33:54.880]  when you only have the module because you don't know how everything's going to be talking to
[33:54.880 --> 33:58.460]  it. So that's why we're trying to build our systems up to eventually do full vehicle
[33:58.460 --> 34:10.880]  assessments. So, good question. Yeah, yeah. Oh, cool. We'll talk later. Any other questions?
[34:12.900 --> 34:17.720]  Alright, if you guys have any, just ask or if not, just stop by our booth. Uh, thanks again.